problem importing IDS into MC 2.2

ldeera · ‎09-28-2006

I have already added 5 4210's to my platform but one just wont allow it self to be added I keep getting the following error;

10.39.1.106: Import

Import failed due to exceptionError importing configuration files from the sensor - Unable to import sensor config using RDEP: java.lang.Exception: An exception occurred during the import of file(null), detail=Error on line 1: The root element is required in a well-formed document.

Import Completed

Looks like it doesn't like line 1 of the config on the box;

the first few lines look like this;

! ------------------------------

! Version 5.1(3)

! Current configuration last modified Thu Sep 28 15:24:42 2006

! ------------------------------

display-serial

! ------------------------------

service interface

physical-interfaces FastEthernet0/0

admin-state enabled

exit

has anyone seen this eror and resolved it?

cheers

lCd

jjohns2 · ‎09-28-2006

You are not alone.

I've just upgraded a pair of 4215 to 5.1.3 and upgrade the ISP MC to 5.1.3 and get the exact same error message. I have TAC case open. I'll post an update ASAP.

netcraftjason · ‎10-11-2006

Hi All,

I am facing the same issue on my 2 new implementations. Both cannot import the 5.1.3 sensor.

And I cannot find any TAC case opened on Cisco about this issue. Does anyone know the latest update about this issue? Thanks!

Jason,

Best regards,

wiluszm · ‎11-10-2006

Hey,

Did anyone get a response from TAC on this? I just opened a case earlier in the week with a sensor that has the same problem.

-Mike

http://cs-mars.blogspot.com

netcraftjason · ‎11-16-2006

Hi All,

After upgrade to 5.1.4 Service Pack on Sensor and MC, this issue is still in existence! Anyone know about the solution?

rpalanis · ‎11-30-2006

Hello everyone,

Any one of you got any solution for this?

Please let me know if there is solution

jjohns2 · ‎12-04-2006

Here is what the TAC recommended for my issue.

I have not got back to try this yet but it is my game plan:

"I would like to reset all the signatures on the sensor to default, get the sensor into VMS and then reapply your tunings.

the quickest/easiest way to do this, in my opinion, is from the CLI with

an ftp server.

or-sensor1# copy current-config ftp: (then enter the information for an

ftp server that you can write to, or just show conf and capture the

output)

or-sensor1# conf t

or-sensor1(config)# default service signature-definition sig0

or-sensor1(config)# exit

or-sensor1#

Next attempt to add to VMS, make sure that works. Then reapply the

tunings that we want. Then Re-Import on VMS to make sure it has the

current settings."

Hope this helps.

attmidsteam · ‎12-09-2006

It is a problem with the "Version" seen by VMS.

you will notice that there is now an AV version in show ver that was never there before. If you did not upgrade the sensors by pushing from VMS then re-importing immediately after upgrade you will see this error.

To see it directly try querying the sensor (configuration-->setting-->identification) and you will see the version mis-match.

Workarounds are downgrading then importing or asking for a patch not yet widely available.

Hope this helps

wiluszm · ‎12-15-2006

Here is the root cause I received from the IPS MC developers:

If the IPS MC has the main sensor version and does not have the anti-virus update version

while importing the sensor, then this issue occurs.

The fix is a SP1 patch available from TAC. The filename is CSM301SP1_Patch.zip. Once I applied this patch and rebooted the CSM server I was able to import my 4215s without issues and update signatures to S261.

-Mike

http://cs-mars.blogspot.com

netcraftjason · ‎12-17-2006

Hi Mike,

I have applied the patch from TAC but after this I cannot Generate the configuration for the sensor. On Process Explorer it prompts error on generate configuration. The sensor version and MC version are the same at 5.1.4. Also I did this on a ASA-SSM with 5.1.3 version this issue also appeared!

Jason

Thank,